defillama-wallet-en-us[.]pages[.]dev

The domain defillama-wallet-en-us.pages.dev is flagged as a crypto‑drainer operation. Infrastructure analysis shows the hostname resolves to IP 172.66.47.198, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is protected by a Google Trust Services / WE1 SSL certificate, indicating a legitimate‑looking TLS layer. HTTP inspection returned a 403 status code, and the server advertises HSTS and HTTP/3, consistent with a Cloudflare‑fronted service. The domain was created on 21 February 2026 and is registered through Cloudflare, Inc. with nameservers ajay.ns.cloudflare.com and nadia.ns.cloudflare.com.

Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. Google Safe Browsing classifies the site as social engineering, and PhishDestroy has blocked it. VirusTotal analysis records nine detections out of ninety‑three scanned vendors, reinforcing the malicious rating. The page title, "DefiLlama Wallet — Secure Multi‑Chain Crypto Management," suggests an attempt to impersonate a legitimate DeFi service, but no visual content has been examined.

The current operational status is offline, indicating the site may have been taken down or is temporarily unavailable. Defenders should treat any URLs pointing to this domain as high‑risk for credential harvesting or unauthorized cryptocurrency transfers. Immediate actions include adding the domain and its IP address to blocklists, updating intrusion detection signatures to flag HTTP 403 responses from this host, and monitoring for related phishing campaigns that reference the DefiLlama brand. Continuous re‑evaluation is advised in case the infrastructure re‑appears under new subdomains or IP ranges.